Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15/03/2024, 04:31
General
-
Target
2024-03-15_435e3c1d0a50fc55daf0650e5b29b0d3_cryptolocker.exe
-
Size
55KB
-
MD5
435e3c1d0a50fc55daf0650e5b29b0d3
-
SHA1
72ccab462fb60cd72b7bf2bf770011215fde8a20
-
SHA256
969da383cbecd1c8b617f06629d8895775157a9e5adcf1c451aa7627f813fee0
-
SHA512
f95b973520977ee13e337a6c15f88ac57ba88d52668c56adc81fa8194a3bdc55623aa1f863e54a75edced8fe543c9ea9f0255f0c3abddbdd0b6ac8f155a98a78
-
SSDEEP
768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5axpS:z6QFElP6n+gKmddpMOtEvwDpj9aYaK
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_435e3c1d0a50fc55daf0650e5b29b0d3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_435e3c1d0a50fc55daf0650e5b29b0d3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD53c1c743d11c2ff3d94c163259a9c8e42
SHA1fbc6458bfa83224791d6832f80c52a14c2b48c8c
SHA25679e44e26b24b66b3e38e0a0a89932d5fa14e05b9d34016caeba195dc680983a0
SHA512af7cf80950495950698086442491fe153cb3a8240f21444ca3824c17e661ecd1f3af6c6caf2574de7eabcce43a73d6d76605fcce8d74e2270dfe9082c4b8770a
-
Filesize
56KB
MD52ec726c7f44afdb5d00d353b0a5aa144
SHA1bc6efa0ef41d3d16a7d5134bbe90b1e79d4263db
SHA256115b6245616861657397b29eb797eafbcffb8153918c9af9ec4faa3a4dfd2cd3
SHA51292b193bb46f7a6e80fe77c063703b49d81e9708fb9cbd117690606cf4100cd65b49dc36fb344a24b765be2d3f89eae63b8a4cd5681043981b9cdd28d02e032b7
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB